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REMARKS 

Claims 1-11 are pending . 

The specification has been amended, and the abstract revised, 
to address the objections in the Office Action. 

Claims 1-3 are rejected under 35 U.S*C, § 103(a) as being 
obvious in view of Howard and Moriconi. This rejection is 
respectfully traversed. 

Claim 1 recites a method of authenticating a user of a client 
computer at a server computer executing a distributed application 
on a plurality of data processing agents, the method comprising 
(1) receiving a service request from the user at a first data 
processing agent, (2) submitting an authentication request from 
the first data processing agent tp a second data processing agent, 
to authenticate the user, (3) receiving a response to the 
authentication request at the first data processing agent from the 
second data processing agent, and (4) if the received response 
indicates that the user is successfully authenticated, providing 
the requested service to the user. 

Howard is seen to show a system in which a client 100 
attempts to access a web page on an affiliate server 104, and if 
the user is not authenticated at the affiliate server, the user is 
redirected to an authentication server 110. The authentication 
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server authenticates the user, seta "cookies" on the client 
containing authentication and user profile information, and 
redirects the client, to the affiliate server, which then provides 
a personalized web page to the user based on the user profile 
information that appears in the cookies set by the authentication 
server - 

It is noted that the Office Action does not specify exactly 
how claim 1 is being read on Howard* It is assumed in the 
following remarks that the "first data processing agent" of claim 
1 is being read on the affiliate server 104, and that the "second 
data processing agent." is being read on the authentication server 
104. If this assuttption is not correct, it is respectfully 
requested that a subsequent Office Action indicate specifically 
how the Howard reference is being applied and that Applicant be 
provided an opportunity to respond accordingly. 

Moriconi shows a method for maintaining security in a 
distributed computing environment utilizing a "policy manager" and 
an "application guard" located on a client for managing access to 
securable components as specified by the security policy. Figure 
5 and associated text in columns 10-11 describe that the 
application guard is integrated with the application 312 via an 
interface 512, and contains an authorization engine 316 for 
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example. Although the Office Action alleges that this part of 
Moriconi shows first and second data processing agents, it does 
not specify which specific components of Moriconi are being taken 
as these two claimed elements. While the authorization engine 316 
presumably receives authorization recjuests from the application 
312, there is not seen to be any intermediate component that 
receives service requests from the application 312 and in turn 
provides the requested service after receiving authorization from 
the authorization engine 316. 

It is respectfully urged that the combination of Howard and 
Moriconi do not render claim 1 obvious under 35 U.S,C. § 103(a). 
Contrary to the assertions in the Office Action^ neither of these 
references teaches or suggests the following elements recited in 
claim 1 : 

submitting an authentication request from the first data 
processing agent to a second data processing agent to 
authenticate the user, 

receiving a response to the authentication request at 
the first data processing agent from the second data 
processing agent, and 

if the received response indicates that the user is 
successfully authenticated, providing the requested service 
to the user, 
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In Howard, the authentication request is submitted from the 
client system to the authentication server after the client system 
has been redirected by the affiliate server. The affiliate server 
receives the service request but does not generate an 
authentication request to the authentication server - that task is 
left to the client. Similarly, the affiliate server does not 
receive a response from the authentication server to an 
authentication request generated by the affiliate server. It only 
receives information after the client itself has requested and 
received authentication from the authentication server. Thus, 
Howard does not show an authentication method in which an 
authentication request is submitted from a first data processing 
agent to a second data processing agent to authenticate a user, 
and in which a response to the authentication request is received 
at the first data processing agent from the second data processing 
agent . 

Furthermore, Moriconi does not teach br suggest such an 
authentication method, either, and in fact the Office Action has 
not alleged any such teaching in Moriconi. Moriconi shows only 
that an application has an "application guard" interface to an 
authorization engine, but not first and second data processing 
agents that interact in the manner set forth in claim l. 
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Because neither Howard nor Moriconi teach or suggest the 
above elements of claim l, these references cannot render claim 1 
obvious under 35 U.S.C. § 103(a). Accordingly, claim 1 is 
believed to be allowable notwithstanding the teaching of these 
references. 

The remaining claims incorporate, either directly or 
indirectly, the abofve elements of claim 1, and therefore these 
claims are allowable in view of Howard and Moriconi for at least 
the reasons given above with respect to claim 1. 

Favorable action is respectfully requested. The Examiner is 
encouraged to telephone the undersigned attorney to discuss any 
matter that would expedite allowance of the present application. 



Respectfully siibmitted, 
SMARAGDAj HADJINIKITAS ET AL. 
By; ^-^(L^^^i 



w^t.^» F. Thompson 
Regystration No. 3S,699 
Attorney for Appl i cant ( s ) 

WEINGARTEN, SCHURGIN, 

GAQNEBIN & LEBOVICI LLP 
Ten Post Office Square 
Boston, MA 02109 
Telephone: (617) 542-2290 
Telecopier: (617) 451-0313 
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